how we RUN Script which convert binary index data into csv and again save it into same index?

[ajitshukla]

Hi please help me ,I have Universal forwarder install on another machine ,which send binary data to splunk insatnce .
On splunk instance I want ot RUN python script which will convert the binary data into csv and save it into another index.

before this I was able to run pyhton script on Universal Forwarder which will convert binary data into csv file and forwarder monitor that csv file and send it to splunk.

But my requirement has changed now I want to run pyhton script on splunk instance which will convert binary data coming from forwarder to csv in real time.

please help

[badarsebard]

Unfortunately there's no way to do this. One of the hard requirements of Splunk is that forwarded data is in text, no binary. The only way I see around this is to transmit the binary data through a different channel like sftp, rsync, etc. to a directory on the Splunk instance and then use a scripted input to convert the binary data to csv.

[vishaltaneja070]

@ajitshukla

If data is coming to Splunk then you can create a report using search command and outputlookup the result to a csv file.

[ajitshukla]

but converting binary data to csv logic written in python script ,so in any case I have to use python script